docs: privacy impact assessment + tenancy defense-in-depth review

[BigSimmo]

What this is

Analysis-only. No product code changes — two new documents under docs/.

Produced by a multi-agent audit: one auditor agent per API route family, with every claimed gap independently re-verified against source and the live Supabase project (sjrfecxgysukkwxsowpy, region ap-southeast-2 / Sydney).

Deliverable 1 — docs/privacy-impact-assessment.md

Full clinical-data flow map (the incidental-PHI path where a clinician types patient details into a query). Covers:

• What reaches OpenAI (raw query + retrieved excerpts, US endpoint, store:false, forced 24h prompt cache) and the cross-border (APP 8) posture.
• Logging/redaction per table — the audit's M15 HMAC query-hash fix is verified present (query-privacy.ts:17-23) but downgrades to unsalted SHA-256 if RAG_QUERY_HASH_SECRET is unset, which nothing enforces in prod.
• Retention/purge — both pg_cron purges (rag_queries 30d, rag_retrieval_logs 90d) verified live and active; rag_query_misses has no purge.
• Data residency — at-rest data is onshore (Sydney); only OpenAI inference crosses to the US.
• APP / WA health-records assessment and a risk-ranked gap register (PIA-1…7).

Deliverable 2 — docs/tenancy-defense-in-depth-review.md

Adversarial audit of all 33 API routes for a missed/bypassable owner_id filter (RLS is deliberately service-role-only, so the app layer is the only boundary).

• Result: 0 confirmed cross-tenant leaks. Per-route verdict table + RPC SQL-body owner-filter table + response-cache analysis.
• Key caveat: the SQL owner helper retrieval_owner_matches fails open on a NULL filter — the DB has no independent tenancy floor; only the app-layer throw-on-missing-owner prevents a leak.
• Honest cost/benefit on owner-scoped RLS as a second layer: recommends cheaper, higher-leverage fixes first (fail-closed RPCs + CI guard + cross-tenant integration test) over a full RLS refactor.
• One low-severity non-tenancy finding (setup-status:165 raw error string) + two latent/operator notes.

Notes

• Not legal advice; the privacy assessment is written to hand to a privacy officer / counsel.
• No ingestion/answer-generation/search/privacy behaviour changes → clinical governance preflight N/A (docs only).

🤖 Generated with Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.